
What's in this issue?
California Senate Bill 1099
Question of the Quarter
Question of the Quarter
CFPB Adjusts Annual Thresholds for Credit Cards, HOEPA, and QM but Excludes Credit Card Penalty Fees Safe Harbors
Question of the Quarter
NCUA's 2023 Supervisory Priorities
CFPB Nonbank Supervision and Enforcement
FCC Reconsiders 2020 TCPA Order
SCOTUS Agrees to Hear Challenge of CFPB’s Funding Constitutionality

Preparing for TruStage™ 2023
Compliance Systems has been a part of the CUNA Mutual Group (CMFG) team since our acquisition in 2018. In that time, we’ve continued to deliver best-in-class compliance technology via the CMFG Fintech Solutions division.
In May 2022, CUNA Mutual Group announced its plan to unify its business under a single brand: TruStage™. While that time is almost here, you can expect the same industry leading financial transaction technology and compliance expertise you have come to know. We will continue to deliver the products and capabilities you know and trust, you’ll work with the same teams you rely on today, and you’ll receive the same high level of service you deserve.
Later this year, we will reintroduce ourselves as TruStage—aligning a full array of products and services under the TruStage brand and bringing a simplified and more cohesive experience for you. We will share more about this transformation in upcoming issues of this newsletter.
Join Our Community Lounge!
The Community Lounge is your resource for the latest Simplicity and industry knowledge. It also has FAQs, job aids, video tutorials, and more!
We have recently restructured the Lounge to make topics more accessible. You can discover what’s new, what’s the same, and how to leverage the new Lounge layout by viewing a short recorded session available on the Community Lounge.
Visit the Community Lounge and click the “Click to Login” button to register for your free account.


Credit Card Late Fees: Regulation Z Proposed Rule
On February 1, 2023, the Consumer Financial Protection Bureau (CFPB) issued a Notice of Proposed Rulemaking (NPRM) to amend Regulation Z limitations for credit card late fees.
The proposed rule amends Regulation Z § 1026.52 and the Official Commentary. The proposed amendments are listed below.
-
Lowers the safe harbor for credit card late payment fees to $8.00 and excludes that amount from being adjusted annually to reflect changes in the Consumer Price Index.
-
Eliminates a higher safe harbor dollar amount for late payment fees for subsequent late payments; and
-
Prohibits card issuers from imposing a late payment fee that exceeds 25% of the amount of the required minimum periodic payment due immediately prior to the assessment of the late payment fee.
The safe harbors that apply to other types of penalty fees, and the annual adjustments, are not impacted by this NPRM.
Many are concerned that, if enacted as proposed, this rule will cause card issuers to replace the income from late fees by increasing annual percentage rates or other fees associated with credit card accounts. In this environment of increasing rates, affordable credit could be more difficult to obtain.
The CFPB is seeking comments on the proposed rule. You can view the unofficial redline of § 1026.52 and the commentary here.
California Senate Bill 1099
In 2022, California Senate Bill 1099 (SB 1099) was passed by Governor Newsom amending, in part, § 2983.3 of the Civil Code and § 22329 of the Financial Code to prohibit the following as events of default on a motor vehicle loan:
Filing of a petition for bankruptcy under Title 11 of the United States Code by the borrower or other person liable on the loan.
Status of the borrower or other person liable on the loan as a debtor in a bankruptcy.
SB 1099 became effective on January 1, 2023. Fortunately, these prohibitions on what may constitute default on a motor vehicle loan do not apply to financial institutions when doing a direct loan with a consumer.
California Civil Code § 2982.5(a) states that Chapter 2b of the Civil Code, which includes the amended § 2983.3, does not apply to motor vehicle loans made by supervised financial organizations to a consumer. A supervised financial organization is defined as “a person organized, chartered, or holding a license or authorization certificate under a law of this state or the United States to make loans and subject to supervision by an official agency of this state or the United States.”
Furthermore, California Financial Code § 22050(a) states that Division 9 of the Financial Code, which includes the amended § 22329, does not apply to banks or credit unions.
Appropriately, no changes pursuant to SB 1099 are required for your closed-end loan agreements.
Question of the Quarter
QUESTION:
Can I offset a delinquent credit card account against funds of the cardholder held on deposit at my financial institution?
ANSWER:
No. Regulation Z § 1026.12(d) prohibits offsetting credit card accounts. This prohibition does not impact your ability under state or federal law to obtain and enforce a consensual security interest in the funds held at your financial institution. Additionally, it does not affect your right to establish a specific pledge to freeze funds held at your financial institution and secure the credit card account.

FinCEN Issues Proposed Rulemaking for Access and Safeguards of Beneficial Ownership Information
The Corporate Transparency Act (CTA) was enacted into law through the National Defense Authorization Act in 2021. It is comprised of three rulemaking parts. In September 2022, the Financial Crimes Enforcement Network (FinCEN) published the first set of final regulations detailing the beneficial ownership information (BOI) reporting requirements. On December 15, 2022, FinCEN issued a Notice of Proposed Rulemaking (NPRM), which marks the second of the three proposed rules implementing the CTA. The NPRM provides details as to who may receive BOI, how the information may be used and protected, and the penalties for violations. The NPRM also includes clarification on the use of FinCEN Identifiers for entities.
Receiving and Using BOI
The proposed rule permits FinCEN to disclose BOI to financial institutions complying with Customer Due Diligence (CDD) requirements.
The NPRM also requires financial institutions to have the business’s consent prior to requesting the BOI for CDD compliance. For each request for BOI, the financial institution must certify in writing that it obtained consent, and the BOI will assist in compliance of CDD. Furthermore, regulators analyzing a financial institution’s CDD compliance may only request and receive BOI the financial institution previously requested.
Protecting BOI
Proposed requirements for financial institutions to protect BOI would take a principles-based approach. Financial institutions would be required to develop and maintain administrative, technical, and physical safeguards. The proposed rule does not prescribe specific safeguards that must be implemented.
Fortunately, financial institutions complying with § 501 of Gramm-Leach-Bliley Act, or other federal or state laws that are at least as protective, to protect non-public customer personal information are provided a safe harbor under 31 CFR 1010.955(d)(2)(i).
Penalties for Violation
The CTA establishes civil and criminal penalties for violation of the proposed rule. Civil penalties of $500 for each day a violation continues or has not been remedied can be assessed.
Criminal penalties include a fine of not more than $250,000, imprisonment for up to five years, or both. If a person commits a violation while violating any other law or as part of a pattern of illegal activity involving more than $100,000 within a 12-month period, they can be fined up to $500,000 and imprisoned for up to 10 years.
The period for comments expired on February 14, 2023. The proposed effective date is January 1, 2024, to align with the BOI reporting rules effective date.
The NPRM can be viewed here. We will continue to monitor this.

Regulatory Agency Focus on Overdraft Programs in 2023
The Consumer Financial Protection Bureau (CFPB) and the National Credit Union Administration (NCUA) have announced that overdraft programs and related fee assessments will be a focus of their rulemaking and supervisory priorities in 2023.
CFPB’S Fall 2022 Rulemaking Agenda
Overdraft programs and related fee assessment practices will remain a supervisory focus for the CFPB. The agency has published its Fall 2022 rulemaking agenda, which lists regulatory matters that it reasonably anticipates considering from December 1, 2022, through November 30, 2023. Two of the agenda items in the pre-rule stage pertain to overdraft and non-sufficient funds (NSF) fees.
-
Overdraft Fees: Certain types of overdraft services are subject to Regulation Z if the fees imposed in connection with those services are considered finance charges. When the Federal Reserve Board first adopted Regulation Z in 1969, it created special rules for determining when overdraft fees are considered finance charges. The CFPB acknowledges that the nature of overdraft services has changed significantly since that time, including how accounts can be overdrawn and how financial institutions determine whether to advance funds to cover overdrawn amounts, yet these special rules have remained largely unchanged. The CFPB is considering whether to propose amendments to Regulation Z with respect to the special rules.
-
NSF Fees: The CFPB recognizes that NSF fees have been a significant source of fee revenue for financial institutions but notes that some institutions have voluntarily stopped charging such fees. Still, the CFPB is considering whether to issue new rules pertaining to NSF fees.
The CFPB estimates pre-rule activity for these agenda items to occur in November 2023, but clarifies the date is simply a placeholder. We will continue to monitor any further developments in the CFPB’s rulemaking process.
The rulemaking agenda follows other recent actions by the CFPB that support its initiative to reduce or eliminate what it considers exploitive junk fees. Last year, the CFPB issued guidance that targets surprise overdraft fees and surprise depositor fees, stating they are “likely unfair and unlawful under existing law.” The CFPB also filed enforcement actions and assessed significant penalties against two banks due to their practices of assessing surprise overdraft fees on preauthorized debit card transactions.
NCUA’s Supervisory Priorities
Credit union overdraft programs will remain an area of focus for examiners in 2023. Specifically, they will expand their reviews to include website advertising, balance calculation methods, settlement processes, and will evaluate any adjustments credit unions have made to their overdraft programs to address consumer risk and potential consumer harm from unanticipated overdraft fees.
Financial Institution Considerations
Given the continued attention to overdraft programs and related fee assessments, financial institutions are encouraged to review their own policies and practices and determine if any changes are warranted to mitigate potential risk. Be sure that applicable disclosures are updated as needed to align with such changes.
Question of the Quarter
QUESTION:
Regulation D no longer requires us to impose transfer limits on savings deposits, and we are planning to eliminate them for all our savings and money market accounts. Are we then required to treat those accounts as transaction accounts for purposes of Regulation CC?
ANSWER:
No. The Federal Reserve Board addresses this issue in its Savings Deposits Frequently Asked Questions (see FAQ #13). Your financial institution may continue to treat and report the accounts as savings deposits and impose deposit holds for longer periods than those established in Regulation CC for transaction accounts.

Update to What You Should Know About Home Equity Lines of Credit Brochure
The Consumer Financial Protection Bureau (CFPB) announced an update to the What You Should Know About Home Equity Lines of Credit brochure. This consumer publication is required under the Real Estate Settlement Procedures Act (RESPA) implemented by Regulation X and Truth in Lending Act (TILA) implemented by Regulation Z. This new version of the brochure was updated to align with the CFPB’s educational efforts, be more concise, and improve readability.
Although the CFPB has not provided a mandatory effective date to start using this revised HELOC brochure, financial institutions are encouraged to being using the new version immediately.
CFPB Adjusts Annual Thresholds for Credit Cards, HOEPA, and QM but Excludes Credit Card Penalty Fees Safe Harbors
On December 23, 2022, the Consumer Financial Protection Bureau (CFPB) issued its final rule regarding the 2023 annual adjustments for several provisions of Regulation Z. Below are the 2023 threshold updates.
Credit Cards
The minimum interest charge amounts for §§ 1026.6(b)(2)(iii) and 1026.60(b)(3) remain unchanged at $1.00 for the year 2023. Accordingly, the CFPB did not amend those sections of Regulation Z. The CFPB did not mention credit card penalty fees safe harbors, which are set forth in Regulation Z § 1026.52(b)(1)(ii)(A) and (B).
HOEPA
The CFPB increased the total loan threshold to $24,866 and the current points and fees threshold to $1,243. As a result, in 2023, a transaction will be a high-cost mortgage if: (1) the total loan amount is $24,866 or more and the points and fees exceed 5.00% of the total loan amount; or (2) the total loan amount is less than $24,866 and the points and fees exceed the lesser of $1,243 or 8.00% of the total loan amount.
Qualified Mortgage Rule
The points and fees limits and associated loan amount limits for 2023 to:
-
3.00% of the total loan amount for loan amounts equal to or greater than $124,331.
-
$3,730 for a loan amount greater than or equal to $74,599 but less than $124,331.
-
5.00% of the total loan amount for a loan amount greater than or equal to $24,866 but less than $74,599.
-
$1,243 for a loan amount greater than or equal to $15,541 but less than $24,866.
-
8.00% of the total loan amount for a loan amount less than $15,541.
The adjustments reflect changes in the Consumer Price Index and became effective January 1, 2023. The CFPB published these changes much later than expected, giving mortgage lenders little time to implement them by the effective date. View the final rule in its entirety here.
Question of the Quarter
QUESTION:
With the United States District Court for the District of Columbia vacating the 2020 HMDA Final Rule, making the new threshold for reporting data on closed-end mortgages loans 25, my financial institution is now HMDA reportable. What information do we have to report?
ANSWER:
HMDA rules provide that mortgage lenders must report HMDA data where their loan volume meet specific thresholds in the two preceding calendar years. HMDA data covers home purchase and home improvement loans and refinances, and contains information about loan originations, loan purchases, and denied, incomplete, or withdrawn applications. With some exceptions, the lender reports data for each transaction about the:
-
Loan or application.
-
Status of the application.
-
Property to which the loan relates.
-
Applicants’ demographic information.
-
Sale of the loan if it was sold.
Please refer to the FFIEC Home Mortgage Disclosure Act for more information about HMDA reporting.
Additionally, the CFPB, National Credit Union Association, Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, and Federal Reserve Bank announced that they will not initiate enforcement actions or cite HMDA violations for failures to report closed-end mortgage loan data collected in 2020 through 2022 for financial institutions that meet Regulation C’s other coverage requirements and originated at least 25 closed-end mortgage loans in each of the two preceding calendar years but fewer than 100 closed-end mortgage loans in either of the two preceding calendar years.

NCUA's 2023 Supervisory Priorities
The National Credit Union Administration (NCUA) released its 2023 supervisory priorities and other updates to the agency's examination program. These priorities focus on areas that pose the highest risk to credit union members, the industry, and the National Credit Union Share Insurance Fund (Share Insurance Fund). Below are the NCUA’s primary areas of supervisory focus in 2023.
Interest Rate Risk
NCUA's examinations will review interest rate risk (IRR) programs for the following key risk management and control activities:
-
Key assumptions and related data sets are reasonable and well documented.
-
The credit union’s overall level of IRR exposure is properly measured and controlled.
-
Results are communicated to decision-makers and the board of directors.
-
Proactive action is taken to remain within safe and sound policy limits
Liquidity Risk
Examiners will be reviewing credit union liquidity policies, procedures, and risk limits and will be evaluating the adequacy of the credit union’s liquidity risk management framework relative to the size, complexity, and risk profile. Liquidity management will be assessed by evaluating:
-
Scenario analysis for changes in cash flow projections for an appropriate range of relevant factors (e.g., changing prepayment speeds).
-
Appropriateness of contingency funding plans to address unexpected liquidity shortfalls.
Credit Risk
Examiners will review the soundness of existing lending programs, any adjustments the credit union made to loan underwriting standards and portfolio monitoring practices, and loan workout strategies for borrowers facing financial hardships. All factors related to the credit union’s efforts to provide relief for borrowers facing financial hardships will be assessed, including whether the efforts were reasonable and conducted with proper controls and management oversight.
Fraud Prevention and Detection
The NCUA will be implementing a questionnaire designed to enhance the identification of fraud red flags, material supervisory concerns, or other potential new risks.
Information Security
Examiners will evaluate if credit unions have established adequate information security programs to protect members and the credit union. The NCUA has also developed new Information Security Examination procedures that will be used this year tailored to institutions of varying size and complexity.
Consumer Financial Protection
The NCUA will continue to review compliance with applicable consumer financial protection laws and regulations. Examiners will also evaluate credit unions’ compliance with Flood Disaster Protection Act requirements, including disclosure requirements. Other areas examiners will focus on include:
-
Overdraft programs.
-
Fair lending, including review of residential real estate appraisals for any bias.
-
The Truth in Lending Act.
-
The Fair Credit Reporting Act.
The NCUA also highlighted updates to current expected credit loss implementation, succession planning, and support for small credit unions and minority depository institutions.
These supervisory priorities and other updates can be found here.
CFPB Nonbank Supervision and Enforcement
Recently, the Consumer Finance Protection Bureau (CFPB) increased its attention on financial nonbank entities. As a result, there was a 91% increase in the number of nonbank entity enforcement actions in 2021.
In 2022, the CFPB utilized an existing dormant authority under the Dodd-Frank Act to examine nonbank financial companies and target a broader sample of bad actors in the financial sector. The use of the dormant power allows the CFPB to seek enforcement against nonbank covered persons if they pose a risk to consumers, thereby broadening its enforcement authority.
In general, banks and credit unions welcome this increase in nonbank enforcement actions. Many had expressed concern that banks and credit unions were subject to different standards than nonbank entities that perform similar functions. This increase in enforcement of nonbank entities should level the playing field between nonbanks and traditional depository financial institutions.
A review of the CFPB’s Fall 2022 Supervisory Highlights shows no slowdown on enforcement actions for nonbank entities in 2023.
The CFPB recently proposed two rules related to nonbank entities. In December 2022, it issued a proposed rule to create a registry of nonbanks subject to certain agency and court orders in connection with the offering or provision of a consumer financial product or service. The CPFB also issued a proposed rule in January 2023 to create a registry of nonbanks’ use of terms and conditions that seek to waive or limit consumer legal protections.
While these proposed rules do not currently impact banks and credit unions, there is concern that the CFPB will eventually seek to create similar registries for traditional financial institutions.
We will continue to monitor the nonbank enforcement actions and proposed rules.
FCC Reconsiders 2020 TCPA Order
On December 27, 2022, the Federal Communications Commission (FCC) issued an Order on Reconsideration and Declaratory Ruling to clarify its previous amendment to the Telephone Consumer Protection Act of 1991 (TCPA). The 2022 reconsideration permits callers to obtain written or oral consent to make more than the three exempt calls to residential lines for non-telemarketing purposes using an artificial or prerecorded voice. The compliance date is July 20, 2023.
Background
Congress passed section 8 of the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act (TRACED Act) which, in part, required the FCC to establish conditions for calls where a statutory exemption applies under the TCPA.
As a result, the FCC issued a 2020 Report and Order to amend existing TCPA exemptions for non-telemarketing calls made financial institutions to residential lines using an artificial or prerecorded voice.
-
Limits the number of exempted calls to three within any consecutive 30-day period.
-
Requires that residential telephone subscribers be permitted to opt out by dialing a telephone number and with an automated, interactive voice-and/or key press-activated opt-out mechanism.
The amended rule inadvertently required written consent to exceed the numerical limitations applied to exempt calls to residential lines. Previously, the TCPA permitted written or oral consent, and it was not the intention of the FCC to modify that.
Read the full text of the rule here. We will continue to monitor the TCPA.
SCOTUS Agrees to Hear Challenge of CFPB’s Funding Constitutionality
The Consumer Financial Protection Bureau’s (CFPB) petition for certiorari to the Supreme Court of the United States was granted on February 27, 2023. The Court has agreed to decide whether the CFPB’s funding structure violates the Appropriations Clause of the United States Constitution. In its petition, the CFPB asked the Court to expedite the case and hear it this term. That request was rejected, and the case will be heard next term.
In October 2022, the United States Court of Appeals for the Fifth Circuit vacated the CFPB’s payday lending rule, holding that the CFPB’s funding structure is unconstitutional. After the decision, the CFPB filed the petition for certiorari.
The question presented by the CFPB is:
Whether the court of appeals erred in holding that the statute providing funding to the Consumer Financial Protection Bureau (CFPB), 12 U.S.C. 5497, violates the Appropriations Clause, U.S. Const. Art. I, § 9, Cl. 7, and in vacating a regulation promulgated at a time when the CFPB was receiving such funding.
There is no indication that this will prevent the CFPB from pursuing its regulatory agenda; although, we may see an impact to current enforcement activity.

Episode 7: Digitizing Your Banking Solution
The Compliance Insider is the podcast series by Compliance Systems and CUNA Mutual Group’s Fintech Solutions that brings you discussions about industry developments that impact financial institutions, with expert guests and analysis to help navigate change and evolve your business. In our latest episode, we have a conversation with Steve Bishop, Chief Operating Officer at OMB Bank and Jordan Ennest, Product Specialist & Counsel from Compliance Systems about how financial institutions are leveraging digital banking solutions to meet the changing needs of their client base. Please check out all of our episodes and subscribe for updates here.